● Covered by 1 source · 1 reportMedium impact1 neutral
pnpm 12 Released as a Rust Rewrite with Git Dependency and Configuration Improvements
Key points
- pnpm 12 is a rewrite in Rust, compatible with pnpm 11.
- Git dependencies now resolve through canonical HTTPS URLs for major hosts.
- Unrecognized settings in `pnpm-workspace.yaml` are now reported as errors or warnings.
- Lockfiles for cyclic dependency graphs are now canonical.
pnpm 12 Released
pnpm 12 has been released as a stable version. This new iteration is a complete rewrite of the package manager in Rust. Despite the underlying language change, pnpm 12 is designed to be compatible with pnpm 11, retaining the same commands, flags, settings, and lockfile format. Documentation covers both versions to ensure a smooth transition for users.
Installation and Availability
Currently, pnpm 12 is installed using the `next-12` tag via `pnpm self-update next-12`, as the `latest` tag on npm still points to pnpm 11. Other installation methods, including those without Node.js, are available. However, popular package managers like Homebrew, winget, Scoop, and Chocolatey do not yet offer pnpm 12.
Changes to Git Dependencies
A significant change in pnpm 12 involves how Git dependencies are handled. For repositories hosted on GitHub, GitLab, and Bitbucket, specifiers like `github:owner/repo` or `git+https://…` now name a repository rather than choosing a transport. All such dependencies resolve through the host's canonical HTTPS URL, and the lockfile will not record SSH URLs for these hosts. Users needing to access private hosted repositories via SSH must configure Git's URL rewriting globally. Unknown hosts and URLs with embedded credentials retain their exact specified URL.
Improved Configuration Validation
pnpm 12 introduces enhanced validation for `pnpm-workspace.yaml` files. Previously, unrecognized settings were silently ignored, potentially leading to misconfigurations. Now, pnpm reports these unrecognized settings, often suggesting the closest real setting name if it appears to be a typo. If a project pins a pnpm version that the running pnpm satisfies, an unrecognized setting will cause the command to fail with `ERR_PNPM_UNRECOGNIZED_WORKSPACE_SETTINGS`. In other scenarios, it issues a warning, allowing projects to continue functioning while providing notice for cleanup. The `pnpm config` subcommands are designed not to fail on such errors, enabling inspection and repair of broken files.
Canonical Lockfiles for Cyclic Dependencies
The new version also standardizes how lockfiles handle cyclic dependency graphs. Dependency cycles are now broken canonically during peer resolution. Members of each cycle are ordered by package ID, and the edges that close a cycle are consistently cut at the same point where the installation enters the cycle. This change aims to improve the consistency and predictability of lockfiles involving complex dependency structures.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
pnpm 12, a package manager, has been released as a rewrite in Rust, maintaining compatibility with pnpm 11's commands, flags, settings, and lockfile format. This update introduces changes to how Git dependencies are resolved and improves error reporting for unrecognized settings in `pnpm-workspace.yaml` files, which matters for developers using pnpm as it enhances reliability and consistency in dependency management.